stacklok / toolhive / 32170469510

70%

Build Type

push

github

Committed by web-flow

Commit Message

Strip leading UTF-8 BOM before filtering list responses (#6304)

* Strip leading UTF-8 BOM before filtering list responses

A client strips a leading BOM per the WHATWG UTF-8 decode algorithm before parsing, but the response filter decoded and sniffed the raw bytes. Go's encoding/json treats EF BB BF as a syntax error, so a BOM-prefixed list response failed every decode and smuggled-result sniff and passed through unfiltered, leaking policy-denied tools/prompts/resources. The SSE processing path already stripped the BOM; the JSON decode path, the JSON/SSE sniffs in FlushAndFilter, and the tool filter's unrecognized-media-type sniff did not.

Strip the BOM once in FlushAndFilter before the media-type dispatch (covering the JSON path and both default-branch sniffs) and once at the top of processUnrecognizedMimeType in the tool filter. Add regression tests mirroring the existing SSE BOM test.

* Fix BOM response fallback length

Coverage Stats

13 of 13 new or added lines in 2 files covered. (100.0%)

13 existing lines in 5 files now uncovered.

85468 of 121361 relevant lines covered (70.42%)

98.82 hits per line